Elastic high stable eql

Potential Credential Access via Renamed COM+ Services DLL

Identifies suspicious renamed COMSVCS.DLL Image Load, which exports the MiniDump function that can be used to dump a process memory. This may indicate an attempt to dump LSASS memory while bypassing command-line based detection in preparation for credential access.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
 [process where host.os.type == "windows" and event.type == "start" and process.name : "rundll32.exe"]
 [process where host.os.type == "windows" and event.code == "7" and
   (file.pe.original_file_name : "COMSVCS.DLL" or file.pe.imphash : "EADBCCBB324829ACB5F2BBE87E5549A8") and
   /* renamed COMSVCS */
   not file.name : "COMSVCS.DLL"]

Field Validations

Loading…

Comments (0)

Loading comments...